Potential Windows Defender Tampering Via Wmic.EXE — Detection Rule

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read the full analysis on IntelFusions